Let´s not forget that the deck house is probably more than 100 meters away from the Engine Room, but I assume most of the engineers were already in the Engine Control Room at the time of first blackout.
AV - possible. Think DG2 coming on line and closing the breaker would not have happened if the ICMS failed. Not sure if there is a UPS for the ICMS or directly fed from batteries.
Some of the bridge equipment such as radars/ecdis/(most important) Gyro would normally be fed from a separate UPS. I think the VDR would be recording most of the info from the wheelhouse instruments. Is it possible that this vessel had no UPS or that it failed? Certainly looks like it started recording only after the EDG came online.
DG2 came online after the second blackout, maybe at that time the ICMS had restarted as power was available from LV Main Switchboard. I have had this situation when after a blackout the automatic recovery did not work because the UPS could not keep the load and shutdown the ship´s main automation system.
Even though the first blackout was caused by the unexpected tripping of the main transformer breakers, there must have been another hidden defect in the system, either an UPS or the Power Management System itself. That delayed the recovery and could have initiated the second blackout. A generator breaker can only be opened manually, by its protection relay upon sensing a fault condition or remotely by PMS. We can exclude manual opening by crew. Tripping by protection relay would have been recorded by the same relay and it is not mentioned in the report. That leaves the last option, tripping by PMS. The PMS is a different kind of beast, sometimes it is programmed to initiate a blackout upon detecting low frequency or low voltage on main bus bars. All running generators are tripped and the stand-by is started and connected.
Agree. Very possible.
At 0127:13 the pilot ordered left rudder
By 0127:30 the pilot, the apprentice pilot, the master, the mate, and the helmsman were all looking at the rudder angle indicators
They all talked to the NTSB - can’t imagine the NTSB did not ask if they saw rudder response
This is an important piece of data missing from the preliminary report
Thinking about this further, there should have been an alarm recorded in the alarm log. Depending on the setpoint for the alarm and the trip and associated time delay, I think some indication should be present in the alarm log. The event log and alarm log should be reviewed in conjunction.
So the next question, how does the PMS open the HR1 breaker. Definitely not by the trigger mechanism for the safety trip. So leaves us with a shunt trip or the UV coil. Makes sense both are installed.
Also makes sense the PMS would be configured to trip (energize) the shunt coil. I cannot think of any reason why this breaker would not be equipped with a UV coil. (Same with all the large consumers such as the reefers as well as the BT). Intent is that the breaker cannot be closed unless there is voltage upstream (HV) and will de-energize and open the breaker on power interruption and cannot be closed until power is restored. Possible the only breaker that will remain closed is the feeder for the so called ‘lube pump’ in the PR that I think is the hydraulic oil pump for the main engine (that is no UV coil installed).
So then, if there is a momentary dip in frequency or voltage, possible the voltage drop caused the breaker UV coil to de-energize and drop out the breaker. What could cause this blip in voltage/freq? Think it is related to the trip of DG in port to ‘low fuel pressure’
What a clusterf**k. Blackout that should not have happened. Escalated by possible SG failure. Vessel called Newark and Norfolk before Baltimore. Likely they were busy with heavy maintenance in Newark (piston pull for example) and then long maneuver to Norfolk to continue the maintenance activities and then again a long maneuver to Baltimore to catch their breath and then the unexpected blackouts.
Crew fatigue cannot be ruled out. Been on a similar run decades ago … Newark, Philly and Baltimore. At least we had shoreside help for all the heavy work. But sleep deprivation is a serious condition.
Can somebody confirm that the rudder for the ship was not hard over to Port after it struck the bridge? If it was not hard over then I seriously doubt they ever got steering again after the blackout because there’s no reason for the pilots to have centered the rudder after the ship struck the bridge.
I am going to go back to the idea that somebody had left the motor starter for that third steering gear pump in the off position and not Auto and that omission alone was a difference between the ship managing to avoid the bridge versus what happened
One of the microphones of the VDR is mounted directly above the helmsman’s position. There should be a response to the pilots order and if he didn’t see the rudder indicator move then his response should be recorded. As Texastanker says there would have been more than one set of eyes on the rudder indicator given the circumstances.
I’m referring to large steering gears, all large container ship steering gears are of the 2-ram type. What varies is the number of hydraulic subsystems (3 or 4) as well as many small hydraulic design details even if the basic principle remains the same.
Sorry if I forgot to mention that I wasn’t referring to Playmobil toy ships 
, here the torque can exceed 10 MNm.
Each (main) pump corresponds to a whole hydraulic subsystem which is able to provide hydraulic oil to turn the rudder stock, it’s not just a redundant pump.
For each main pump (for larger container ships around 100 to 160 kW per main pump though one must carefully check how ratings are defined, usually not S1) there is also a small auxiliary fixed-displacement pump (typically around 0.75 to 2 kW) which supplies the hydraulic controls of that subsystem.
The main pump (variable-displacement type) does not provide the hydraulic pressure required for the hydraulic controls of the steering gear, its pressure also constantly varies depending of the reaction couple of the rudder stock.
Nearly all larger hydraulic systems require auxiliary pumps, the main difference being that they’re most often driven by the same motor as the main pump(s) and those small pumps are often just coaxially mounted behind one or several main pumps (which may als include internal booster pumps). Sometimes there can be maybe 5 stacked pumps, often there are more than one auxiliary pump.
Here for each main pump pump there’s a separate auxiliary (“servo”) pump.
The arrangement with main 4 pumps is the most logical one as 2 pumps can be used for one ram. With 3 main pumps the design becomes asymmetric.
BTW The separate oil tank located somewhat higher above the ground is only a hydraulic oil reserve to make the replenishment of any of the 3 or 4 hydraulic subsystems easier if there are leaks.
Please let know where I’m wrong.
According to the NTSB preliminary report when the Dali left the dock all three steering pumps were online (page 7).
It’s a SOLAS requirement that one steering pump be on the emergency switchboard, in this case steering pump #3. It’s also a SOLAS requirement that this pump restart automatically when power is restored.
I’m not sure that is necessarily true. “It all depends on the actual arrangement of the controls” says it all. For example if no 3 was not running but was selected as standby on the bridge I would think once its starter was getting power from the EDG it’s starting circuit would see no other pump running and start. Additionally, pump status is displayed on the bridge. No running lights would mean to try selecting the E powered pump. Of course a bridge rapidly filling your view might have been distracting. Without operator error it’s hard for me to imagine it was not running. Not being effective is another story and one best told by other commenters.
Do the rules specify if other hydraulic steering gear pumps which were running as the blackout happened must also restart automatically when regular power is restored?
I also find it sort of surprising that there’s no requirement to be able to locally (at the steering gear switchgear) select any pump to run on emergency power.
If, in this example Pump #3, would not have been available for any reason, emergency steering would not have been possible.
AFAIK you can’t select a specific pump as on stand-by as only one pump is supplied by the EBUS (Emergency Power Bus), the other pumps are supplied by the LV BUS. That pump can’t be changed, or at least not easily as two supply cables connections would have to be inverted and usually one will end too short when trying such modifications and it would not even be possible if ratings are differents.
The bridge control for the steering gear itself is mostly, for each pump, an “ON” and an “OFF” pushbutton, as well as a small pilot light matrix (front-panel-mount individually replacable indicator lights arranged in a rectangular matrix) for statuses and faults, some of them are mandatory. In some cases an audible alert is required.
If at least one pump is running when power is lost, if a different pump is the one supplied by emergency power, it woud be questionable if that pump would no start automatically once emergency power is available. But what happens after the blackout? Is the originally selected pump restarted and the one running on emergency power shut down automatically?
Handling such details would require a PLC and to avoid single points of failure it should be redundant but now we end with additional complexity which is not necessarily justified and may decrease reliability.
Usually all pumps can be run in any combination but if there’s a failure, if the defective ram locks the other ram an alarm is triggered and someone must open manually the bypass valve in order to unlock the blocking ram (it could also be handled automatically but the steering gear controls are mostly rather basic an require it to be done manually).
That said Im not sure everything is that well tested, it happens that some wiring errors are only discovered once a specific fault or fault combination occurs. They don’t perform systematic wiring verifications at the same level as for SIL 3 safety control systems.
.
I forgot to mention that some ram-type hydraulic steering gears designs feature an auxiliary hydraulic pump driven by the same electric motor as the corresponding main hydraulic pump, in such case the small pump is usually located coaxially behind the main pump. It’s a wiser and more reliable design and corresponds to usual industrial hydraulics designs.
.
When restarting the additional steering gear hydraulic pumps when regular power is restored the motor starts must be sequenced.
On large container ships many large pumps as well as the auxiliary blowers of the ME (Main Engine) are started directly, called DOL (Direct On-Line) start in the non-IEC world. The start durations depend on the load and especially its inertia but typically during several seconds the current is very high (more than 1000 A for the large motors of a ship like M/V Dali).
Even if start times are only a few seconds, simultaneous starts can cause an overload which will not selectively disconnect a starting motor as the so-called thermal overcurrent protection must be set in order to allow the motor to start with sufficient reserve before tripping the protection.
If the setting is too low, the protection will trip, if set too high the motor may be damaged if there’s a mechanical overload.
Ideally, for the larger motors specialized protection relays should be used as they allow a much better motor protection and a more detailed monitoring, not only when the motor starts.
A well designed PMS should handle restart sequences according to priorities and taking in account different configurations.
I’m not sure if for example someone tries to start several steering gear pumps at the same time from the bridge pressing the “ON” pushbuttons simultaneously there is a protection which delays the start of the 2nd, 3rd, and if present, the 4th pump (as example, not referring to the incident voyage).
There are to possible rationales:
- It’s important to avoid as reliably as reasonably possible overloads of the power generation and distribution system, so let’s the Power Management System (PMS) deny or sequence some start requests to avoid breaker trips and other issues.
- The steering gear is mission-critical and therefore the PMS is not allowed to interfere. In such case operators must handle manually controlled starts themseleves in a way to not cause problems.
Though as many motors will be started from the ME Control Room, coordination issues may arise as both bridge and control room staff will be very busy during just after a blackout. The distance between the front and rear superstructure of the M/S Dali is around 105 m (344 ft.), the engine room is rougly located under the rear supestructure with the stacks, the rudder stock is located about 60 m (197 ft.) astern of the rear superstructure. It’s not like if you can take the elevator from the brige and access directly the engine room (though some other large container ships only have one superstructure and a very long propeller shaft).
There are pros and cons for each option. The issue is rather that in case of emergency some precitpitated actions cannot be excluded.
Personally I prefer automated protections but they must be very reliable, i.e. redundant automation without single point of failure and very high degree of diagnostic coverage, which means quickly and reliably detecting a fault affecting one of the redundant systems and not having to wait until the 2nd system fails to discover that the 1st has already failed maybe months before without anyone noticing it (common example: non-monitored batteries which fail when required but as long as regular power is available it goes unnoticed because everything works normally).
Yes. That is what the rules say. When the power comes back the run switch is till closed so it starts.
I don’t find this in the least surprising. In fact It would seem strange to me. You seem to be imaging a plant where all spaces are continuously manned and people are ready to close switches and levers.
This is not what I have ever seen. My experience it is arranged more as a selection, off- 1 run 2 stby, 2 run 1 stby etc but this is for the old fashioned traditional P-T hydraulic system type. However with these hydrostatic hydraulic types I suspect the same control techniques would be required to meet rules and to maximize flexibility / emergency response.
Using this Kawasaki set up as an example…
It appears that you could run either No. 1 or No. 2 alone to provide steering or run them together since they have an anti-locking feature incorporated since two separate pumps are supplying two separate rams and could in theory oppose one another. I have no reason to believe that the third pump could not be set to auto start with EDG power available. A selection like 1&2 running 3 in standby could easily be achieved. Although in the example all pumps can be running - even a “standby” pump. Because you would have the pump off stroke and it’s main directional valve is in by-pass as well. Could be some heat build up over time but only required to send signal to the unloading valve pilot to put it instantly online.
Why do you believe this. Ships have started large motors using star start-delta run for ages. Some even used autotransformers. Now with soft starters so common it’s hard for me to imagine a large motor starting across the line anymore.
Steering gear motor protection is spelled out by rule as well, phase loss and overload alarm indication only etc etc.
Glad that you responded. I had to exercise great restraint.
PS: In any case, we do not need to worry about AI taking over our lives.
Seriously? Must be really large diameter ram cylinders and wonder how the moment arm on the tiller is compensated. Dali is a large container ship … are you certain they have a 2 ram steering system?
@ KPChief:
Thanks for you detailed reply. Reply follows.
.
@ retdmarineengineer:
Yes, 4 cylinders and two rams. 4x 250 kW and more for the very large ones. M/S Dali maybe roughly around 3x 132 kW.
EDITED:
The definition is not strictly uniform. 4-cylinder-type with Rapson’s slide may be referred to both as 2-ram and 4-ram, even by manufacturers.
Not sure where you get this terminology from. A ram is associated with a cylinder. 4 cylinders means 4 rams. In many cases, the ram is a single forging for 2 opposite cylinders - instead of a coupling between the opposing cylinders.
This does not make it a ‘2 ram system’.
It does not read like a human had anything to do with it. If that is not some juvenile exercise in AI I will be very surprised.
And it’s too many words to read lol
Indeed something else! Throwing out terms like S1 rating without understanding Solas requirements for the SG motors, SIL 3 (safety instrumented level) that is very rare to achieve in the O&G business, etc, etc. And confusing number of poles on an alternator to claiming the rpm of the genies as 720 and the EG at 1800 rpm. I mean come on, at 4000kW+ it could be 600 or even 450. Really not relevant. And then claiming we do not know the difference and get confused between kW and KVA. It goes on and on.
Most of us engineers can see through this … my concern is this information can be confusing for the mates, masters and pilots.
Btw, he I see the post is edited …
Tiring.